Introduction
High-risk Artificial Intelligence (AI) has been rapidly introduced across sectors of society, which has required strict compliance and verification rules. Cybersecurity architects, confronted with adversarial vulnerabilities and algorithmic drift, are turning to Distributed Ledger Technology (DLT) as a decentralised infrastructure for automated compliance.1 By combining the analytical capabilities of AI with the tamper-proof ledger of a blockchain, organisations can create verifiable event logs, track the provenance of data sets and maintain immutable audit trails. The use of an append-only distributed ledger to meet statutory AI logging requirements, however, raises an unexamined techno-legal paradox between statutory personal data privacy rights and continuous regulatory oversight.
This convergence is rooted in a structural conflict between mandatory AI transparency regimes and personal data rights. Article 12 of the European Union AI Act requires high-risk AI systems to allow for the automatic recording of events (logs) over their lifetime, so that their functioning remains traceable and auditable. Cryptographically linking system logs to an immutable chain answers this need for auditability.2 This mathematical certainty, however, runs headlong into statutory requirements to erase data: the right to be forgotten under Article 17 of the EU GDPR and the erasure obligations of Section 12 of India’s Digital Personal Data Protection (DPDP) Act 2023. Data protection laws call for the permanent removal of personally identifiable information (PII), but the cryptographically linked blocks of a blockchain are designed never to delete historical data.
This paper asks whether privacy-protecting techniques (off-chain key scrubbing, redacted hash pointers and zero-knowledge proofs) satisfy statutory “data erasure” requirements while preserving the chain of custody and evidentiary integrity needed in judicial proceedings and regulatory audits. Using a doctrinal and comparative techno-legal method, it considers whether the destruction of cryptographic decryption keys or the deletion of metadata pointers amounts to valid and lawful “functional erasure” under data privacy law while meeting the non-repudiation requirements of administrative compliance. The study compares the risk-based approach of the European Union’s regulatory framework with India’s nascent statutory framework under the DPDP Act 2023 and the proposed Digital India Act, which are likely to have a profound influence on regulation in the Global South. Analysing these standards together offers a common legal and normative basis for cross-border deployments of AI and clarity for policymakers, enterprise software developers and judges.
Regulatory background: AI logging mandates and blockchain as a compliance tool
A. The EU AI Act mandate for automatic logging
Under the EU Artificial Intelligence Act, high-risk AI systems must incorporate technical measures that ensure their auditability and protect them against misuse by unauthorised third parties. In particular, Article 12 requires such systems to allow for the automatic recording of events over their lifetime, so that the behaviour of the system and its algorithmic decisions remain traceable. This is complemented by Article 15, which requires high-risk AI systems to achieve an appropriate level of accuracy, robustness and cybersecurity, including resilience against errors and faults. Article 15 also refers specifically to technical measures against AI-specific vulnerabilities, such as attacks that manipulate the training data set (data poisoning), inputs designed to cause the model to make a mistake (adversarial examples), and model poisoning; it separately requires systems that continue to learn after deployment to address the risk of biased feedback loops. To meet these requirements, AI system architectures should include mechanisms for generating and storing logs that record system events, data inputs and changes to system parameters, which third parties or regulators can audit to ensure compliance.3
B. Blockchain as a compliance safeguard
Distributed Ledger Technology (DLT) provides a decentralised approach that directly addresses the record-keeping and data-governance needs set out in new regulations for artificial intelligence. Permissioned or public blockchains form an append-only, immutable ledger that provides integrity and non-repudiation by chaining blocks of transactions across a peer-to-peer network.4 Blockchain platforms can store cryptographic hashes of training data sets, model weights and decision outputs on the chain while the raw personal data are stored securely off-chain; this preserves both the verifiable identity of the data used to train the models and the privacy of that data. In addition, self-executing smart contracts can run security playbooks, enforce security policies and record, in real time, every change to security controls, every access request and every threat response. This cryptographic integration produces a verifiable audit trail that can support compliance demonstrations before courts and regulators.
C. The Indian regulatory horizon
The regulation of AI in India is moving from sectoral guidelines towards a statutory framework. There is at present no legislation that directly regulates the operation of AI-based systems; the subject is addressed indirectly under the Information Technology (IT) Act 2000, which provides for compensation for failure to protect sensitive personal data (Section 43A) and punishes cheating by personation using a computer resource (Section 66D).5 To mitigate the risks posed by generative and under-tested AI models, the Ministry of Electronics and Information Technology (MeitY) has issued advisories on the deployment of unreliable AI models and on metadata identifiers for AI-generated media. India is also moving towards a holistic approach through the Digital Personal Data Protection (DPDP) Act 2023 and the proposed Digital India Act, which is expected to address cybersecurity record-keeping, algorithmic accountability and consent management.
The privacy collision: the “right to be forgotten” versus permanent ledgers
A. Normative bases of erasure rights
Modern privacy laws rest on the normative idea that individuals hold a fundamental autonomy over their personal data. The European Union General Data Protection Regulation (GDPR) grants data subjects an explicit “right to erasure” (also referred to as the “right to be forgotten”), which entitles them to obtain the deletion of their personal data where, among other grounds, they have withdrawn their consent and there is no other legal ground for the processing, or the data have been unlawfully processed.6 In India, the Digital Personal Data Protection (DPDP) Act 2023 similarly imposes an affirmative duty on Data Fiduciaries to erase personal data when a Data Principal withdraws consent or when it is reasonable to assume that the specified purpose is no longer being served (Section 8(7)), and on receiving a request for erasure from a Data Principal (Section 12(3)).7 Under both frameworks, erasure is a right that every data subject must have and also a means of reducing the risk of security breaches, unauthorised use and profiling. These regimes, however, assume a single entity that stores the records and can delete them simply; that assumption fails for decentralised, immutable systems, where enforcing erasure becomes legally contested.
B. Technical immutability and statutory deletion
This legal command conflicts directly with the architecture of Distributed Ledger Technology (DLT). Blockchains are cryptographically designed to be append-only: a transaction or event log added to a block cannot be retroactively changed, overwritten or deleted, because a distributed consensus mechanism maintains agreement among the network nodes. This non-repudiable immutability provides data integrity for cybersecurity, threat logging and the verification of AI data sets. The ledger’s “mathematical inability to forget”, however, places personal data recorded on it in direct tension with the right to erasure under Article 17 of the GDPR and Section 12 of the DPDP Act.8 Technical mitigations, such as storing on-chain only a cryptographic hash of, or a metadata pointer to, raw data held off-chain in IPFS or a cloud cluster, separate the ledger from the raw PII, but it remains doubtful whether the unalterable hash references themselves fall within the definition of pseudonymous personal data under evolving judicial frameworks.
C. Evidence and chain of custody
The tension is compounded by the essential role of undeletable audit logs in judicial proceedings, administrative oversight and digital forensics. A blockchain’s tamper-proof ledger serves as a verifiable chain of custody that preserves historical authenticity and integrity, which is crucial in civil litigation and regulatory investigations into AI system failures and algorithmic harm.9 Logs kept under Articles 12 and 15 of the EU AI Act serve as evidence of an AI system’s compliance, of the absence of model drift, and of liability in administrative audits, and that evidential value depends on the logs remaining unaltered. Blocking or altering historical blocks to meet privacy requirements could jeopardise the integrity of the cryptographic hash chain, compromise digital forensic evidence and impair judicial trust in automated compliance records. Legal frameworks must therefore address how to balance “evidential integrity”, necessary for judicial and regulatory review, with “functional erasure” (for example, the destruction of keys) or cryptographic anonymisation.
Techno-legal evaluation of proposed mitigation mechanisms
A. Off-chain data storage and cryptographic pointer scrubbing
To reconcile these demands, technical architects often propose off-chain databases such as IPFS or cloud storage to hold the raw information that is subject to erasure requirements, while only cryptographic hashes or metadata pointers are anchored on-chain. In this model, “data deletion” is performed by scrubbing or unlinking the off-chain pointers and destroying the cryptographic keys, which removes the ability to reach the underlying data from the chain. From a legal standpoint, however, there is no settled position among regulators on whether this satisfies Article 17 of the GDPR and Section 12 of the DPDP Act 2023.10 As regulators examine more closely whether key destruction amounts to “absolute erasure” rather than advanced anonymisation, concerns have been raised that it may not amount to erasure at all, since cryptographic breakthroughs or quantum computing could one day make historical on-chain data re-identifiable.
B. Zero-knowledge proofs (ZKPs) and privacy-preserving verification
Zero-Knowledge Proofs (ZKPs) present an attractive alternative, allowing AI systems to prove cryptographically that they meet requirements, such as the parameters used to train the model or the origin of the data, without revealing personal characteristics on the blockchain.11 ZKPs create verifiable cryptographic attestations on-chain that can serve the record-keeping and robustness requirements of Articles 12 and 15 of the EU AI Act while avoiding the processing of PII in the append-only ledger. Although the legal benefits may be significant, ZKPs carry substantial computational costs, and there is as yet no guidance on how they should be interpreted or weighed when introduced in court proceedings or administrative audits.
C. Redactable blockchains and chameleon hash functions
A more intrusive technical mitigation is the “redactable” or “mutable” blockchain, which provides a mechanism by which authorised consensus nodes may edit, overwrite or redact earlier blocks of transactions.12 Mutable ledgers comply directly with the legal mandate to remove personal data physically, but they carry harsh consequences for the integrity of the record.13 The ability of central authorities or validation pools to change historical blocks compromises the non-repudiation properties of the ledger, corrupts the digital chain of custody and can render automated compliance logs inadmissible as forensic evidence in civil and criminal litigation.
Normative and legislative framework for harmonization
A. Redefining “data erasure” in distributed AI contexts
To overcome this structural dilemma between append-only distributed ledgers and data protection requirements, the legal framework needs to move from a deletion-based approach to a doctrine of functional erasure. The normative reason for the erasure requirements of Article 17 of the EU GDPR and Section 12 of the DPDP Act 2023 is to prevent further undue processing of data and to eliminate the risk of privacy harm and unlawful profiling once the period of lawful retention has ended.14 Where logs kept for the purposes of Articles 12 and 15 of the EU AI Act are anchored on a blockchain, their integrity depends on the cryptographic chain, which the physical removal of earlier blocks would break. Crypto-shredding (the destruction of cryptographic keys) and off-chain, unlinkable anonymisation should instead be recognised in law as functional erasure.15 If the decryption keys or metadata pointers are permanently destroyed, the residual data on the chain become, mathematically, indistinguishable from random noise, without any change to the historical audit trail, and the risk of re-identification is reduced to a negligible level.
B. Governance of key management and audit nodes
To give effect to functional erasure, the main custodians and node operators must be identified and assigned clear liability and a duty of care. In decentralised AI compliance networks, responsibility for compliance needs to be distributed among the relevant custodians, validation nodes and system developers. In India, an entity that manages keys will be a “Data Fiduciary” under the Digital Personal Data Protection Act 2023 where it determines, alone or with others, the purpose and means of processing personal data; as such it must erase personal data once consent has been validly withdrawn or on a request for erasure, and key destruction is the technical means of doing so that this paper proposes.16 In permissioned enterprise blockchain systems, node operators may act as controllers or processors within the meaning of the GDPR, depending on their role. Legislative frameworks should require threshold cryptography or Multi-Party Computation (MPC), which distributes decryption capability across multiple independent audit nodes, to guard against negligent or bad-faith retention of decryption keys. Node operators should be required by statute to honour cryptographic revocation signals, so that a node that destroys a key also destroys the corresponding off-chain records while the integrity of the ledger is maintained.
C. Interoperability and cross-border regulatory acceptance
The incoherence of existing regulatory systems, including the divergence between Western and emerging Asian regimes, is a significant compliance challenge given that high-risk models and decentralised compliance networks operate across sovereign jurisdictions. The European Data Protection Board (EDPB) and the Data Protection Board of India (DPBI) should develop joint regulatory guidance that recognises certified cryptographic compliance mechanisms.17 A uniform approach across jurisdictions to the technical criteria for “irreversible anonymisation” and “functional erasure” would allow a single DLT-backed AI audit system to comply both with the logging requirements of the EU AI Act and with the consent-withdrawal provisions of India’s DPDP Act. By creating cross-border regulatory sandboxes and mutual recognition frameworks, jurisdictions can avoid fragmentation, offer legal clarity to multinational technology innovators and protect individual privacy rights in digital ecosystems around the world.18
Conclusion and policy recommendations
A. Summary of findings
This paper has examined, from the perspectives of Artificial Intelligence (AI) governance and Distributed Ledger Technology (DLT), the techno-legal paradox created by the collision between mandatory regulatory auditability and statutory personal data privacy rights. Through Articles 12 and 15, the EU AI Act requires the automatic logging of events and resilience against data poisoning and security exploits, requirements that providers increasingly meet through append-only ledgers; such ledgers conflict with the “right to be forgotten” in Article 17 of the EU GDPR and with the erasure rights that follow the withdrawal of consent under India’s DPDP Act 2023.19
The analysis shows that absolute physical deletion and immutable auditability cannot be achieved together within traditional database paradigms. With privacy-preserving cryptographic solutions, however, such as off-chain storage with cryptographic hashes, zero-knowledge proofs (ZKPs) and Multi-Party Computation (MPC), organisations can separate raw personally identifiable information (PII) from on-chain audit trails. Immutability and data privacy are therefore not mutually exclusive. The structural tension can be resolved only by moving away from a literal model of physical deletion to a legally recognised doctrine of “functional erasure”, under which the on-chain record of the destruction is irrevocable, the remaining encrypted data are cryptographically inaccessible, and the destruction can be verified by judicial and administrative authorities.
B. Legislative recommendations
To implement this harmonization, policymakers, data protection authorities and AI regulators should translate the following measures into legislative amendments and guidelines:
Statutory recognition of “functional erasure”. A definition of “functional erasure” should be added, by legislative amendment, to Article 17 of the EU GDPR and Section 12 of India’s DPDP Act 2023.
Standard. The verified, irreversible cryptographic destruction of decryption keys (“crypto-shredding”) and of off-chain pointers should be accepted as full compliance with the statutory obligation to erase data, provided that the residual risk of re-identification falls within mathematically acceptable “zero-knowledge” limits. The European Data Protection Board (EDPB) and the Data Protection Board of India (DPBI) should jointly develop technical compliance standards that set out acceptable off-chain and on-chain architectures.
Threshold metrics. Guidelines should specify key lengths, protocols for zero-knowledge proofs and multi-signature key-governance systems, so that compliance logs are admissible as digital forensic evidence under national evidence law.
Cross-border techno-regulatory sandboxes. Regulators in Western (EU and US) and Global South (Indian) jurisdictions should create joint regulatory sandboxes to test DLT-based AI audit systems. Policymakers should build on international instruments, such as the Council of Europe Framework Convention on Artificial Intelligence and the Bletchley Declaration, by harmonizing cross-border evidentiary standards, so that multinational enterprises can deploy a single blockchain audit trail that complies in every jurisdiction without incurring conflicting penalties.
*****
Footnotes
1. Sana Abdulbaqi Al-Qubati, Integrating Artificial Intelligence and Distributed Ledger Technology for Enhanced Cybersecurity: Opportunities and Challenges, in 2025 International Conference on Innovation in Artificial Intelligence and Internet of Things (AIIT) 1 (IEEE 2025), https://doi.org/10.1109/AIIT63112.2025.11082902.
2. Dlovan Wrya Hamad Ameen, AI-Driven Secure Audit Trails for Financial Compliance Using Immutable Blockchain Logs, in 2025 3rd International Conference on Cyber Resilience (ICCR) 1 (IEEE 2025), https://doi.org/10.1109/ICCR67387.2025.11292506.
3. See Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act), arts. 12, 15, 2024 O.J. (L 1689) 1; Sanjay Goel & Gurvirender Tejay, Editorial: Are We Ready for Auditing AI-Based Systems?, 2 Org. Cybersecurity J.: Prac., Process & People 77 (2022), https://doi.org/10.1108/ocj-08-2022-037.
4. Sai Srujan Gutlapalli, Commercial Applications of Blockchain and Distributed Ledger Technology, 4 Eng’g Int’l 89 (2016), https://doi.org/10.18034/ei.v4i2.653.
5. See The Information Technology Act, 2000, §§ 43A, 66D, No. 21, Acts of Parliament, 2000 (India) (§ 43A to be omitted by the Digital Personal Data Protection Act, 2023, § 44(2)(a), with effect eighteen months after Nov. 13, 2025); Tanvir Kaur & Jaskaran Singh, Regulating AI in India: A Comparative Analysis with International Standards, 21 Econ. Sci. 595 (2025), https://doi.org/10.69889/ksaa2139.
6. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation), art. 17, 2016 O.J. (L 119) 1; see also Diana Dimitrova, Right to Rectification or Erasure of Personal Data and Restriction of Processing, in The EU Law Enforcement Directive (LED): A Commentary 293 (Eleni Kosta & Franziska Boehm eds., 2024), https://doi.org/10.1093/law/9780192855220.003.0016 (discussing the parallel right under Article 16 of the Law Enforcement Directive).
7. The Digital Personal Data Protection Act, 2023, §§ 6(4)–(6), 8(7)(a), 12(3), No. 22, Acts of Parliament, 2023 (India). Sections 6(1)–(8), 8 and 12 come into force eighteen months after November 13, 2025. See Notification G.S.R. 843(E), Gazette of India, Extraordinary, pt. II sec. 3(i) (Nov. 13, 2025) (India).
8. T. Sérgio Cabral, Forgetful AI: AI and the Right to Erasure Under the GDPR, 6 Eur. Data Prot. L. Rev. 378 (2020), https://doi.org/10.21552/edpl/2020/3/8.
9. Karun Sanjaya & Abhishek Benedict Kumar, AI, Blockchain, and the Future of Evidentiary Electronic Records, in Legal and Regulatory Perspectives on Electronic Records as Evidence 249 (Cathrine Nengomasha ed., IGI Global Sci. Publ’g 2025), https://doi.org/10.4018/979-8-3373-3023-5.ch010.
10. Eugenia Politou, Efthimios Alepis, Maria Virvou & Constantinos Patsakis, The General Data Protection Regulation, in Privacy and Data Protection Challenges in the Distributed Era 13 (Springer 2021), https://doi.org/10.1007/978-3-030-85443-0_3.
11. Sushmita Ruj, Zero-Knowledge Proofs for Blockchains, in 2024 54th Annual IEEE/IFIP International Conference on Dependable Systems and Networks: Supplemental Volume (DSN-S) 67 (IEEE 2024), https://doi.org/10.1109/dsn-s60304.2024.00028.
12. Di Zhang, Junqing Le, Xinyu Lei, Tao Xiang & Xiaofeng Liao, Exploring the Redaction Mechanisms of Mutable Blockchains: A Comprehensive Survey, 36 Int’l J. Intelligent Sys. 5051 (2021), https://doi.org/10.1002/int.22502.
13. Efat Fathalla, Chonggang Wang, Xu Li, Robert Gazda & Hongyi Wu, Redactable Distributed Ledgers: A Survey, 2 Distributed Ledger Techs.: Rsch. & Prac. 1 (2023), https://doi.org/10.1145/3596224.
14. Benjamin J. Keele, Note, Privacy by Deletion: The Need for a Global Data Deletion Principle, 16 Ind. J. Global Legal Stud. 363 (2009), https://doi.org/10.2979/gls.2009.16.1.363.
15. Loveth A. Ebong & Gertrude Fischer, Cloud Security Using Crypto-Shredding for Secure Data Deletion: A Reduction in Cyber Security Risks, 31 Global J. Pure & Applied Sci. 683 (2025), https://doi.org/10.4314/gjpas.v31i4.6.
16. The Digital Personal Data Protection Act, 2023, §§ 2(i), 8(7)(a), 12(3), No. 22, Acts of Parliament, 2023 (India). On the commencement of sections 8 and 12, see supra note 7.
17. See Joanna Kulesza, Right to Be Forgotten in the Global Information Economy, in Comparative Privacy and Defamation 216 (András Koltay & Paul Wragg eds., Edward Elgar Publ’g 2020), https://doi.org/10.4337/9781788970594.00021.
18. Ama Oduma Annan, Data Privacy Governance Models for Cross-Border Digital Platforms, 3 Int’l J. Multidisciplinary Rsch. & Growth Evaluation 949 (2022), https://doi.org/10.54660/.ijmrge.2022.3.6.949-964.
19. Khaled Fattah & Basma Mohamed, The Role of Law in Addressing the Risks of Using Artificial Intelligence, 12 Int’l J. Sci., Tech. & Soc’y 151 (2024), https://doi.org/10.11648/j.ijsts.20241205.12.